Merge ~sbeattie/ubuntu-cve-tracker/+git/ubuntu-cve-tracker:kernel-triage-bits into ubuntu-cve-tracker:master

[Steve Beattie]

This commit series does a few things around kernel cve re-triage:

- It updates the find-fixes script added by Cengiz to support configuring the location of an upstream linux git clone in the ~/.ubuntu-cve-tracker.conf file

- It renames the find-fixes script to kernel-find-fixes, to make it clear the context for which the script is intended

- It adds documentation on how to do this to the README.linux document, including how to set the git clone up to include linus' primary tree, the linux-stable tree, and the linux-next tree

- It also adds documentation on a few other tthrackers that can be useful for iudentifying fixing CVEs, including their configuration in the ~/.ubuntu-cve-tracker.conf file, as well as referencing the scripts that can use them.

Explicitly adding Cengiz as a reviewer, to make sure the renaming of the find-fixes script won't break the kernel team's workflow.

[Seth Arnold (seth-arnold)]

Nice, thanks

[Steve Beattie (sbeattie)]

> > +git clone //git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git "$linux_kernel_path"
>
> I think this is missing a leading 'https:'

Quite right, amended commit to add it (along with adding refs to
the merge proposal in the commit messages) and re-pushed the merge
proposal branch.

Thanks!

--
Steve Beattie
<email address hidden>

[Cengiz Can (cengizcan)]

Thank you! No it won't break any workflows. ACK.

review: Approve

diff --git a/README.linux b/README.linux
index 5a4d90b..48dae64 100644
--- a/README.linux
+++ b/README.linux
@@ -1,14 +1,85 @@
 Distro kernels
 --------------
+
 Ubuntu kernels as part of the archive are listed here:
-https://wiki.ubuntu.com/Kernel/Dev/ABIPackages
+<https://wiki.ubuntu.com/Kernel/Dev/ABIPackages>
+
+LTS HWE backport kernels from interim releases are typically not
+supported once the next LTS backport kernel is available. For example,
+once the linux 6.2 (mantic 23.10) kernel was brought back to Ubuntu
+22.04 LTS (jammy), the prior HWE kernel in jammy, linux-5.19, no
+longer receives updates.  In older releases, the source package
+names were based on the release codename, e.g. linux-lts-trusty,
+linux-lts-quantal, and linux-lts-saucy.
+
+## Additional infrastructure for retriaging kernel CVEs.
+
+### Upstream kernel trees
+
+It is useful to have a reference clone of the upstream [linux] kernel,
+as well as the [linux-stable] and [linux-next] trees. Additionally,
+the `~/.ubuntu-cve-tracker.conf` file can be configured to point at the
+reference tree for researching issues using the `linux_kernel_path`
+variable. An example snippet to place in `~/.ubuntu-cve-tracker.conf`:
+
+```
+# where to find a clone of the upstream linux, linux-stable, and
+# linux-next kernel trees; see README.linux for more details
+linux_kernel_path='/path/to/git/kernel-trees/linux-reference/'
+```
+
+To set the tree up appropriately, edit ~/.ubuntu-cve-tracker.conf and
+then do something like the following:
+
+```shell
+. ~/.ubuntu-cve-tracker.conf
+git clone https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git "$linux_kernel_path"
+cd "$linux_kernel_path"
+git remote add stable https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
+git remote add next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
+git fetch --all
+```
+
+With this in place, the tool `scripts/kernel-find-fix` will be able to
+look up potential break commits using the Fixes: field from kernel git
+commits.
+
+[linux]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
+[linux-stable]: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
+[linux-next]: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
+
+### Tools for identifying kernel fixes
+
+It is useful to look at some other projects to see if they have
+potentially identified fixes for kernel vulnerabilities. The three
+common ones are the
+
+- [Upstream kernel CNA repo][linux-cna]
+- [Debian's kernel security tracker][debian-kernel]
+- Nicholas Leudtke's [linux github tracker][linux-github]
+
+The latter two can be configured as references in
+`~/.ubuntu-cve-tracker.conf` for use with tools, via the
+`debian_kernel_cve_tracker` and `linux_kernel_cve_tracker` variables
+respectively. An example:
+
+```
+# path to a copy of the linux kernel cve tracker from
+# https://github.com/nluedtke/linux_kernel_cves.git
+linux_kernel_cve_tracker='/path/to/git/cve_trackers/linux_kernel_cves/'
 
-Android kernels (flo, goldfish, grouper, maguro, mako and manta) are not
-supported on the Ubuntu Touch 14.10 and earlier preview kernels.
+# path to a copy of the debian kernel cve tracker from
+# https://salsa.debian.org/kernel-team/kernel-sec.git
+debian_kernel_cve_tracker='/path/to/git/cve_trackers/debian-kernel-sec/'
+```
 
-LTS backport kernels from interim releases are typically not supported once the
-next LTS backprt kernel is available. For example, now that linux-lts-trusty
-is available, linux-lts-quantal and linux-lts-saucy no longer receive official
-support.
+With these configured, the scripts `kernel-triage-missing-break-fix` and
+`kernel-retriage-cve` can be used to look for CVEs where we have
+not identified a fixing commit, but the other projects may have already
+done so.
 
+**TODO**: add support for examining the linux cna repo
 
+[linux-cna]: https://git.kernel.org/pub/scm/linux/security/vulns.git/
+[debian-kernel]: https://salsa.debian.org/kernel-team/kernel-sec.git
+[linux-github]: https://github.com/nluedtke/linux_kernel_cves.git
diff --git a/scripts/find-fixes b/scripts/kernel-find-fixes
 similarity index 96%
 rename from scripts/find-fixes
 rename to scripts/kernel-find-fixes
index a5cbaf1..b8b63a0 100755
--- a/scripts/find-fixes
+++ b/scripts/kernel-find-fixes
@@ -10,7 +10,10 @@
 # USER CONFIGURATION STARTS
 #
 # Should be updated accordingly:
-UPSTREAM_KERNEL_DIR=~/kernel/upstream
+
+[ -f "$HOME"/.ubuntu-cve-tracker.conf ] && . "$HOME"/.ubuntu-cve-tracker.conf
+
+UPSTREAM_KERNEL_DIR="${linux_kernel_path:-~/kernel/upstream}"
 KERNEL_VERSIONS='6.5 6.2 6.1 5.19 5.15 5.14 5.10 5.4 4.19 4.15 4.14 4.9 4.4'
 IFS=" " read -r -a kernel_versions <<< "$KERNEL_VERSIONS"
 #